Security News > 2024 > May > INC ransomware source code selling on hacking forums for $300,000
A cybercriminal using the name "Salfetka" claims to be selling the source code of INC Ransom, a ransomware-as-a-service operation launched in August 2023.
Simultaneously with the alleged sale, the INC Ransom operation is undergoing changes that might suggest a rift between its core team members or plans to move to a new chapter that will involve using a new encryptor.
Currently, there are no public announcements on INC's old or new site about selling the project's source code.
On May 1, 2024, INC Ransom announced on its old leak site that it would move to a new data leak extortion "Blog" and shared a new TOR address, stating the old site would be closed in two to three months.
As opposed to a public leak that allows security analysts to crack the encryption of a ransomware strain, private source code sales of strains for which there's no available decryptor have the potential to create more trouble for organizations worldwide.
When ransomware gangs rebrand, they commonly reuse much of the source code from their old encryptors, allowing researchers to link older gangs to new operations.